Skip to content

Scope parsing, classification & policy config #4176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stevenvegt merged 5 commits into from
Apr 24, 2026
Merged

Scope parsing, classification & policy config #4176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8d0fcac
Initialize branch for PR
stevenvegt Apr 13, 2026
c7fd6ae
Rename PresentationDefinitions to FindCredentialProfile
stevenvegt Apr 13, 2026
2d16cf7
Add tests for multi-scope parsing in FindCredentialProfile
stevenvegt Apr 13, 2026
a0edb15
Add scope_policy config parsing and startup validation tests
stevenvegt Apr 13, 2026
ba9c58b
Apply self-review fixes
stevenvegt Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions auth/api/iam/api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,7 +703,7 @@ func (r Wrapper) PresentationDefinition(ctx context.Context, request Presentatio
return PresentationDefinition200JSONResponse(PresentationDefinition{}), nil
}

mapping, err := r.policyBackend.PresentationDefinitions(ctx, request.Params.Scope)
match, err := r.policyBackend.FindCredentialProfile(ctx, request.Params.Scope)
if err != nil {
return nil, oauth.OAuth2Error{
Code: oauth.InvalidScope,
Expand All @@ -715,7 +715,7 @@ func (r Wrapper) PresentationDefinition(ctx context.Context, request Presentatio
if request.Params.WalletOwnerType != nil {
walletOwnerType = *request.Params.WalletOwnerType
}
result, exists := mapping[walletOwnerType]
result, exists := match.WalletOwnerMapping[walletOwnerType]
if !exists {
return nil, oauthError(oauth.InvalidRequest, fmt.Sprintf("no presentation definition found for '%s' wallet", walletOwnerType))
}
Expand Down
10 changes: 5 additions & 5 deletions auth/api/iam/api_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ func TestWrapper_PresentationDefinition(t *testing.T) {

t.Run("ok", func(t *testing.T) {
test := newTestClient(t)
test.policy.EXPECT().PresentationDefinitions(gomock.Any(), "example-scope").Return(walletOwnerMapping, nil)
test.policy.EXPECT().FindCredentialProfile(gomock.Any(), "example-scope").Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)

response, err := test.client.PresentationDefinition(ctx, PresentationDefinitionRequestObject{SubjectID: verifierSubject, Params: PresentationDefinitionParams{Scope: "example-scope"}})

Expand All @@ -215,7 +215,7 @@ func TestWrapper_PresentationDefinition(t *testing.T) {
walletOwnerMapping := pe.WalletOwnerMapping{pe.WalletOwnerUser: pe.PresentationDefinition{Id: "test"}}

test := newTestClient(t)
test.policy.EXPECT().PresentationDefinitions(gomock.Any(), "example-scope").Return(walletOwnerMapping, nil)
test.policy.EXPECT().FindCredentialProfile(gomock.Any(), "example-scope").Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)

response, err := test.client.PresentationDefinition(ctx, PresentationDefinitionRequestObject{SubjectID: verifierSubject, Params: PresentationDefinitionParams{Scope: "example-scope", WalletOwnerType: &userWalletType}})

Expand All @@ -227,7 +227,7 @@ func TestWrapper_PresentationDefinition(t *testing.T) {

t.Run("err - unknown wallet type", func(t *testing.T) {
test := newTestClient(t)
test.policy.EXPECT().PresentationDefinitions(gomock.Any(), "example-scope").Return(walletOwnerMapping, nil)
test.policy.EXPECT().FindCredentialProfile(gomock.Any(), "example-scope").Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)

response, err := test.client.PresentationDefinition(ctx, PresentationDefinitionRequestObject{SubjectID: verifierSubject, Params: PresentationDefinitionParams{Scope: "example-scope", WalletOwnerType: &userWalletType}})

Expand All @@ -238,7 +238,7 @@ func TestWrapper_PresentationDefinition(t *testing.T) {

t.Run("error - unknown scope", func(t *testing.T) {
test := newTestClient(t)
test.policy.EXPECT().PresentationDefinitions(gomock.Any(), "unknown").Return(nil, policy.ErrNotFound)
test.policy.EXPECT().FindCredentialProfile(gomock.Any(), "unknown").Return(nil, policy.ErrNotFound)

response, err := test.client.PresentationDefinition(ctx, PresentationDefinitionRequestObject{SubjectID: verifierSubject, Params: PresentationDefinitionParams{Scope: "unknown"}})

Expand Down Expand Up @@ -289,7 +289,7 @@ func TestWrapper_HandleAuthorizeRequest(t *testing.T) {
OpenIDProvider: serverMetadata,
},
}
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), "test").Return(pe.WalletOwnerMapping{pe.WalletOwnerOrganization: pe.PresentationDefinition{Id: "test"}}, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), "test").Return(&policy.CredentialProfileMatch{WalletOwnerMapping: pe.WalletOwnerMapping{pe.WalletOwnerOrganization: pe.PresentationDefinition{Id: "test"}}, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
ctx.iamClient.EXPECT().OpenIDConfiguration(gomock.Any(), holderURL.String()).Return(&configuration, nil)
ctx.jar.EXPECT().Create(verifierDID, verifierURL.String(), holderClientID, gomock.Any()).DoAndReturn(func(client did.DID, clientID string, audience string, modifier requestObjectModifier) jarRequest {
req := createJarRequest(client, clientID, audience, modifier)
Expand Down
6 changes: 3 additions & 3 deletions auth/api/iam/openid4vp_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ func TestWrapper_handleAuthorizeRequestFromHolder(t *testing.T) {
})
t.Run("unknown scope", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), gomock.Any()).Return(pe.WalletOwnerMapping{}, policy.ErrNotFound)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), gomock.Any()).Return(nil, policy.ErrNotFound)
params := defaultParams()
params[oauth.ScopeParam] = "unknown"

Expand All @@ -126,7 +126,7 @@ func TestWrapper_handleAuthorizeRequestFromHolder(t *testing.T) {
})
t.Run("failed to generate authorization request", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), "test").Return(pe.WalletOwnerMapping{pe.WalletOwnerOrganization: PresentationDefinition{}}, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), "test").Return(&policy.CredentialProfileMatch{WalletOwnerMapping: pe.WalletOwnerMapping{pe.WalletOwnerOrganization: PresentationDefinition{}}, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
params := defaultParams()
ctx.iamClient.EXPECT().OpenIDConfiguration(context.Background(), holderClientID).Return(&oauth.OpenIDConfiguration{
Metadata: oauth.EntityStatementMetadata{
Expand All @@ -142,7 +142,7 @@ func TestWrapper_handleAuthorizeRequestFromHolder(t *testing.T) {
})
t.Run("failed to resolve OpenID configuration", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), "test").Return(pe.WalletOwnerMapping{pe.WalletOwnerOrganization: PresentationDefinition{}}, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), "test").Return(&policy.CredentialProfileMatch{WalletOwnerMapping: pe.WalletOwnerMapping{pe.WalletOwnerOrganization: PresentationDefinition{}}, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
params := defaultParams()
ctx.iamClient.EXPECT().OpenIDConfiguration(context.Background(), holderClientID).Return(nil, assert.AnError)

Expand Down
24 changes: 12 additions & 12 deletions auth/api/iam/s2s_vptoken_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
t.Run("JSON-LD VP", func(t *testing.T) {
ctx := newTestClient(t)
ctx.vcVerifier.EXPECT().VerifyVP(presentation, true, true, gomock.Any()).Return(presentation.VerifiableCredential, nil)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)

resp, err := ctx.client.handleS2SAccessTokenRequest(contextWithValue, clientID, issuerSubjectID, requestedScope, submissionJSON, presentation.Raw())

Expand Down Expand Up @@ -165,7 +165,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
presentation, _ := test.CreateJWTPresentation(t, *subjectDID, func(token jwt.Token) {
require.NoError(t, token.Set(jwt.AudienceKey, issuerClientID))
}, verifiableCredential)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
ctx.vcVerifier.EXPECT().VerifyVP(presentation, true, true, gomock.Any()).Return(presentation.VerifiableCredential, nil)

resp, err := ctx.client.handleS2SAccessTokenRequest(contextWithValue, clientID, issuerSubjectID, requestedScope, submissionJSON, presentation.Raw())
Expand Down Expand Up @@ -200,7 +200,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
t.Run("replay attack (nonce is reused)", func(t *testing.T) {
ctx := newTestClient(t)
ctx.vcVerifier.EXPECT().VerifyVP(presentation, true, true, gomock.Any()).Return(presentation.VerifiableCredential, nil)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil).Times(2)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil).Times(2)

_, err := ctx.client.handleS2SAccessTokenRequest(contextWithValue, clientID, issuerSubjectID, requestedScope, submissionJSON, presentation.Raw())
require.NoError(t, err)
Expand All @@ -211,7 +211,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
})
t.Run("JSON-LD VP is missing nonce", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
proofVisitor := test.LDProofVisitor(func(proof *proof.LDProof) {
proof.Domain = &issuerClientID
proof.Nonce = nil
Expand All @@ -224,7 +224,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
})
t.Run("JSON-LD VP has empty nonce", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
proofVisitor := test.LDProofVisitor(func(proof *proof.LDProof) {
proof.Domain = &issuerClientID
proof.Nonce = new(string)
Expand All @@ -237,7 +237,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
})
t.Run("JWT VP is missing nonce", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
presentation, _ := test.CreateJWTPresentation(t, *subjectDID, func(token jwt.Token) {
_ = token.Set(jwt.AudienceKey, issuerClientID)
_ = token.Remove("nonce")
Expand All @@ -249,7 +249,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
})
t.Run("JWT VP has empty nonce", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
presentation, _ := test.CreateJWTPresentation(t, *subjectDID, func(token jwt.Token) {
_ = token.Set(jwt.AudienceKey, issuerClientID)
_ = token.Set("nonce", "")
Expand All @@ -261,7 +261,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
})
t.Run("JWT VP nonce is not a string", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)
presentation, _ := test.CreateJWTPresentation(t, *subjectDID, func(token jwt.Token) {
_ = token.Set(jwt.AudienceKey, issuerClientID)
_ = token.Set("nonce", true)
Expand Down Expand Up @@ -297,7 +297,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
t.Run("VP verification fails", func(t *testing.T) {
ctx := newTestClient(t)
ctx.vcVerifier.EXPECT().VerifyVP(presentation, true, true, gomock.Any()).Return(nil, errors.New("invalid"))
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)

resp, err := ctx.client.handleS2SAccessTokenRequest(contextWithValue, clientID, issuerSubjectID, requestedScope, submissionJSON, presentation.Raw())

Expand Down Expand Up @@ -342,7 +342,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
})
t.Run("unsupported scope", func(t *testing.T) {
ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), "everything").Return(nil, policy.ErrNotFound)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), "everything").Return(nil, policy.ErrNotFound)

resp, err := ctx.client.handleS2SAccessTokenRequest(context.Background(), clientID, issuerSubjectID, "everything", submissionJSON, presentation.Raw())

Expand All @@ -364,7 +364,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
presentation := test.CreateJSONLDPresentation(t, *subjectDID, proofVisitor, otherVerifiableCredential)

ctx := newTestClient(t)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)

resp, err := ctx.client.handleS2SAccessTokenRequest(context.Background(), clientID, issuerSubjectID, requestedScope, submissionJSON, presentation.Raw())
assert.EqualError(t, err, "invalid_request - presentation submission does not conform to presentation definition (id=)")
Expand All @@ -375,7 +375,7 @@ func TestWrapper_handleS2SAccessTokenRequest(t *testing.T) {
httpRequest := &http.Request{Header: http.Header{"Dpop": []string{"invalid"}}}
httpRequest.Header.Set("DPoP", "invalid")
contextWithValue := context.WithValue(context.Background(), httpRequestContextKey{}, httpRequest)
ctx.policy.EXPECT().PresentationDefinitions(gomock.Any(), requestedScope).Return(walletOwnerMapping, nil)
ctx.policy.EXPECT().FindCredentialProfile(gomock.Any(), requestedScope).Return(&policy.CredentialProfileMatch{WalletOwnerMapping: walletOwnerMapping, ScopePolicy: policy.ScopePolicyProfileOnly}, nil)

resp, err := ctx.client.handleS2SAccessTokenRequest(contextWithValue, clientID, issuerSubjectID, requestedScope, submissionJSON, presentation.Raw())

Expand Down
6 changes: 3 additions & 3 deletions auth/api/iam/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,9 @@ func (r Wrapper) validatePresentationAudience(presentation vc.VerifiablePresenta
}

func (r Wrapper) presentationDefinitionForScope(ctx context.Context, scope string) (pe.WalletOwnerMapping, error) {
mapping, err := r.policyBackend.PresentationDefinitions(ctx, scope)
match, err := r.policyBackend.FindCredentialProfile(ctx, scope)
if err != nil {
if errors.Is(err, policy.ErrNotFound) {
if errors.Is(err, policy.ErrNotFound) || errors.Is(err, policy.ErrAmbiguousScope) {
return nil, oauth.OAuth2Error{
Code: oauth.InvalidScope,
InternalError: err,
Expand All @@ -94,5 +94,5 @@ func (r Wrapper) presentationDefinitionForScope(ctx context.Context, scope strin
Description: fmt.Sprintf("failed to retrieve presentation definition for scope (%s): %s", scope, err.Error()),
}
}
return mapping, err
return match.WalletOwnerMapping, nil
}
1 change: 1 addition & 0 deletions policy/cmd.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,5 +27,6 @@ func FlagSet() *pflag.FlagSet {
defCfg := defaultConfig()
flagSet := pflag.NewFlagSet("policy", pflag.ContinueOnError)
flagSet.String("policy.directory", defCfg.Directory, "Directory to read policy files from. Policy files are JSON files that contain a scope to PresentationDefinition mapping.")
flagSet.String("policy.authzen.endpoint", defCfg.AuthZen.Endpoint, "Base URL of the AuthZen PDP endpoint. Required when any credential profile uses scope_policy 'dynamic'.")
return flagSet
}
9 changes: 9 additions & 0 deletions policy/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,19 @@

package policy

// Config holds the configuration for the policy module.
type Config struct {
// Directory is the directory where the policy files are stored
// policy files include a scope to presentation definition mapping
Directory string `koanf:"directory"`
// AuthZen contains configuration for the AuthZen PDP integration
AuthZen AuthZenConfig `koanf:"authzen"`
}

// AuthZenConfig contains configuration for an AuthZen-compatible PDP endpoint.
type AuthZenConfig struct {
// Endpoint is the base URL of the AuthZen PDP
Endpoint string `koanf:"endpoint"`
}

func defaultConfig() Config {
Expand Down
43 changes: 37 additions & 6 deletions policy/interface.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,15 +24,46 @@ import (
"github.com/nuts-foundation/nuts-node/vcr/pe"
)

// ModuleName is the name of the policy module
// ModuleName is the name of the policy module.
const ModuleName = "policy"

// ErrNotFound is returned when no credential profile matches the requested scope.
var ErrNotFound = errors.New("not found")

// PDPBackend is the interface for the policy backend
// Both the remote and local policy backend implement this interface
// ErrAmbiguousScope is returned when multiple credential profile scopes are found in a single request.
var ErrAmbiguousScope = errors.New("multiple credential profile scopes found")

// ScopePolicy defines how extra scopes (beyond the credential profile scope) are handled.
type ScopePolicy string

const (
// ScopePolicyProfileOnly only accepts the credential profile scope. Extra scopes cause an error.
ScopePolicyProfileOnly ScopePolicy = "profile-only"
// ScopePolicyPassthrough grants all requested scopes without evaluation.
ScopePolicyPassthrough ScopePolicy = "passthrough"

@reinkrul reinkrul Apr 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we should remove this after the PoCs and "dynamic" is implemented? Because it sounds quite unsafe.

@stevenvegt stevenvegt Apr 21, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's discuss this in #4213 — I think there can be value in a passthrough policy. For now let's keep it in for the PoCs.

// ScopePolicyDynamic evaluates extra scopes via an external AuthZen PDP.
ScopePolicyDynamic ScopePolicy = "dynamic"
)

// CredentialProfileMatch is the result of matching a scope string against the policy configuration.
// It contains the matched credential profile (WalletOwnerMapping + ScopePolicy) and the
// remaining scopes that did not match any credential profile.
type CredentialProfileMatch struct {

@reinkrul reinkrul Apr 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i still find this abstraction a bit weird

@stevenvegt stevenvegt Apr 21, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair — it is a bit awkward. I landed on this shape because the caller needs four things back (profile scope, mapping, policy, other scopes) and a single struct beats a 5-value return. Happy to restructure if you have a concrete alternative in mind.

// CredentialProfileScope is the scope that matched a credential profile.
CredentialProfileScope string
Comment on lines +52 to +53

@reinkrul reinkrul Apr 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Odd naming, it repeats its container, but just "Scope" might be too ambiguous. Abstraction/naming is off, but I can't think of a better one right now

@stevenvegt stevenvegt Apr 21, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed it's imperfect. CredentialProfileScope was the least ambiguous I could find — plain Scope reads as "the scope" (which scope?) when referenced via match.Scope, given the struct already has OtherScopes. Leaving as-is for now; happy to rename if a better name surfaces.

// WalletOwnerMapping contains the PresentationDefinitions per wallet owner type for the matched credential profile.
WalletOwnerMapping pe.WalletOwnerMapping
// ScopePolicy is the configured scope policy for the matched credential profile.
ScopePolicy ScopePolicy
// OtherScopes contains the scopes from the request that did not match any credential profile.
OtherScopes []string
}

// PDPBackend is the interface for the policy backend.
// Both the remote and local policy backend implement this interface.
type PDPBackend interface {
// PresentationDefinitions returns the PresentationDefinitions (mapped to a WalletOwnerType) for the given scope
// scopes are space delimited. It's up to the backend to decide how to handle this
PresentationDefinitions(ctx context.Context, scope string) (pe.WalletOwnerMapping, error)
// FindCredentialProfile resolves a scope string against the policy configuration.
// It parses the space-delimited scope string, identifies exactly one credential profile scope,
// and returns the matched profile along with any remaining scopes.
FindCredentialProfile(ctx context.Context, scope string) (*CredentialProfileMatch, error)

@reinkrul reinkrul Apr 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't it be named "MatchCredentialProfile" if it returns a Match?

@stevenvegt stevenvegt Apr 21, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Going to keep FindCredentialProfile — Go stdlib convention leans toward verbs like Find/Lookup for lookups rather than mirroring the result type (e.g. regexp.Find* returns matches). MatchCredentialProfile reads to me like a verb form of a noun. Open to alternatives if you've got a stronger verb in mind.

}
Loading